A newly identified advanced persistent threat group tracked as UAT-11473 was observed exploiting CVE-2026-20127, an authentication-bypass flaw in Cisco Catalyst SD-WAN Controllers, to deploy a custom malware framework called KeyDrift. Active exploitation has been confirmed, with attackers leveraging the vulnerability to gain unauthenticated remote access and execute arbitrary code on affected controllers. Cisco has released security updates addressing the vulnerability, and administrators are urged to apply the latest firmware updates to mitigate the risk.

What should defenders do?

Apply the latest firmware and software updates for Cisco Catalyst SD-WAN Controllers as released by Cisco. Monitor official Cisco security advisories for update availability and detailed patch instructions. Implement network segmentation to limit exposure of SD-WAN controllers. Review and restrict remote management access where possible.

highCyber Attacks

Hackers exploit Cisco SD-WAN flaw to deploy custom KeyDrift malware

APT group UAT-11473 leverages CVE-2026-20127 to compromise Catalyst SD-WAN Controllers

Cyber.TechVoidPublished about 2 hours agoUpdated less than a minute ago1 min read

Hackers exploit Cisco SD-WAN flaw to deploy custom KeyDrift malware

Key Takeaways

APT group UAT-11473 is actively exploiting CVE-2026-20127 in Cisco Catalyst SD-WAN Controllers.
The vulnerability is an authentication-bypass flaw that allows unauthenticated remote code execution.
Custom malware framework KeyDrift has been deployed in observed attacks.
Cisco has released security updates; immediate patching is recommended.
Organizations using Cisco SD-WAN should verify their firmware versions and apply updates promptly.

Related Security News

highCyber Attacks

Polymarket Suspends Trading Following Third-Party JavaScript Breach

Prediction market platform Polymarket temporarily suspended trading on Thursday after hackers compromised a third-party service to distribute cryptocurrency-draining JavaScript. Security researchers traced approximately $2.5 million in assets to a suspected attacker wallet. The incident highlights the risks associated with third-party integrations in web applications, particularly those handling cryptocurrency transactions.

BleepingComputer3 minutes ago1 min read